Developer Security
Focused developer security articles with clear context, practical examples, source links where needed, and honest limits.
44 articles in this section.
Passkey recovery design: avoid turning the fallback into the weak link
Passkeys improve the normal login path, but account recovery can quietly reintroduce phishing and takeover risk. Recovery deserves the same threat model...
Node.js HTTP agent queue poisoning: what backend teams should verify
HTTP client security fixes deserve more than a version bump. Check connection reuse, proxy behavior, TLS verification, and the libraries that sit betwee...
How to review AI-detected secrets without leaking them again
A security alert can become a second leak when developers paste the credential into tickets, chat, or an AI prompt. Review the finding with hashes, loca...
AI secret detection in GitHub: why context beats token patterns
Secret scanners used to depend heavily on recognizable token shapes. Context-aware detection can find more suspicious values, but teams still need a saf...
WebAuthn passkeys for developers: the server-side mistakes to avoid
Passkeys reduce phishing risk, but the server still has to validate challenges, origins, credentials, and sign counters correctly. The browser prompt is not the
GitHub code scanning's Mitigated reason: when a vulnerability is not fixed
Use GitHub code scanning's Mitigated dismissal reason honestly when external controls reduce risk, while preserving remediation ownership and review evidence.
MCP allowlists in GitHub Copilot: a practical least-privilege setup
Use GitHub Copilot MCP allowlists to control remote and local servers, fail closed on bad settings, and review tool access before enterprise rollout.
GitHub Code Quality Actions path changed: update reports and cost tracking
Update GitHub Actions reports for the dedicated Code Quality workflow path and actor without losing code-scanning history, billing data, or audit visibility.
GitHub OAuth apps with multiple redirect URIs: secure migration guide
Configure GitHub OAuth apps with multiple callback URLs safely, preserve state validation, prevent redirect confusion, and migrate tokens without breaking users.
CodeQL 2.26.3 for JavaScript and GitHub Actions: what teams must retest
Review CodeQL 2.26.3 changes for JavaScript, TypeScript, Vue and GitHub Actions, including a breaking custom-query removal and updated taint models.
CORS preflight caching: reduce OPTIONS traffic without weakening policy
Preflight caching can reduce repeated OPTIONS requests, but it cannot repair an overly broad origin or credential.
Passkey backend verification: the checks tutorials often omit
A browser ceremony is not authentication until the server validates challenge, origin, RP ID, signature, counters, and credential.
CodeQL C++ models-as-data field migration: fully qualified names explained
CodeQL is moving C++ models-as-data fields to fully qualified names. Learn what changes, how to audit custom model packs, and how to migrate without losing coverage.
CodeQL Rust hard-coded cryptographic value alerts: reviewing fewer false positives
CodeQL 2.26.1 added barriers that reduce false positives in Rust hard-coded cryptographic value queries. Learn how to separate test vectors from real secrets.
CodeQL Java path injection false positives with @Pattern: what changed
CodeQL 2.26.1 recognizes some Jakarta and Javax Pattern validators as path-injection sanitizers. Learn when an alert may disappear and when validation is still weak.
CodeQL WebClient SSRF alerts in Spring: how to review and fix them
CodeQL now recognizes Spring WebFlux WebClient URI calls as SSRF sinks. Use this guide to trace user input, restrict destinations, and test the fix.
CodeQL Angular postMessage origin check: fixing new HostListener alerts
CodeQL now traces Angular HostListener message events as remote input. Learn why origin checks matter, how to validate payloads, and how to review new alerts.
npm dual-use package metadata: contentPolicy and DISCLOSURE explained
npm security-sensitive packages may need a contentPolicy field and DISCLOSURE file. Learn what dual-use means, how to package the declaration, and how publishing changes.
GitHub Actions malicious workflow approval: what maintainers should review
GitHub may hold suspicious public-repository workflows for approval. Learn what triggered runs can access, how to review the diff, and when approval is unsafe.
Dependabot malware alerts: enable them and triage a real package alert
GitHub expanded Dependabot malware data beyond npm. This guide shows how to enable malware alerts, verify exposure, contain a package, and avoid unsafe auto-fixes.
npm publish-time malware scanning: fix CI that expects instant installs
npm now scans packages before making them installable. Learn how to handle the normal publishing delay, verify registry availability, and keep release jobs reliable.
Secret scanning validators for Asana, IBM, and MessageBird credentials
GitHub expanded secret-scanning validators for Asana, IBM, and MessageBird credential types. Enable validity checks, map token owners, and rotate active secrets before cleaning history.
Secret scanning public monitoring for enterprises explained
GitHub announced public monitoring capabilities for enterprise secret scanning. Define verified domains and providers, route alerts to an incident queue, and establish external-repository contact procedures.
CodeQL Kotlin 2.4 support: upgrade static analysis with the language
CodeQL 2.26 supports Kotlin versions through 2.4.0. Update CodeQL alongside Kotlin, run a full baseline, and compare extracted files and alert counts.
CodeQL support for Go slog: prevent log injection and clear-text leaks
CodeQL 2.26 adds models for Go’s `log/slog` package to improve log-injection and clear-text-logging analysis. Use stable message templates, structured attributes, secret redaction, and output encoding.
CodeQL Razor Page request sources: catch C# injection paths
CodeQL 2.26 models `OnGet`, `OnPost`, and asynchronous handler parameters as remote-flow sources for C# analysis. Update scanning and review SQL, path, command, and template sinks reached from handler values.
CodeQL SSRF checks for IPv6 transition addresses
CodeQL 2.26 includes an experimental JavaScript query for incomplete IPv6-transition SSRF guards. Parse and normalize addresses with a maintained library, then enforce destination policy after DNS resolution.
Incremental CodeQL analysis: speed up CI without missing the full baseline
GitHub announced incremental analysis improvements for Go, C/C++, and CodeQL CLI workflows. Use incremental checks for fast feedback and schedule full analysis as the authoritative baseline.
Periodic code scanning for inactive repositories: find risk without alert overload
GitHub supports periodic code scanning of inactive repositories for eligible security programs. Target repositories by deployment and dependency risk, then route findings to a real owner.
Fetch GitHub Code Quality findings through REST without building a noisy dashboard
GitHub exposes Code Quality findings through REST for integrations and reporting. Import only findings tied to a clear workflow, deduplicate by stable identity, and sync resolution state.
Self-service credential revocation in GitHub incident response
GitHub added self-service credential revocation capabilities for supported enterprise incident workflows. Define who can revoke, how identity is verified, and how affected automation receives replacement credentials.
GitHub security API access restrictions: audit integrations before retirement
GitHub announced upcoming restrictions to public security API endpoints and related views. List every integration, owner, credential, endpoint, and fallback before enforcement.
GitHub closed security alert retention: export what compliance needs
GitHub announced an upcoming data-retention policy for closed security alerts. Identify audit requirements, export permitted records, and avoid storing sensitive alert details longer than necessary.
GitHub code coverage merge protection: prevent untested changes carefully
GitHub announced code coverage merge protection for pull requests. Baseline by repository, focus on changed code, and provide reviewed exceptions.
GitHub App token format changes: stop validating opaque tokens with regex
GitHub is rolling out a new installation-token format and recommends storage supporting at least 520 characters. Treat tokens as opaque, widen database columns, and test logs, proxies, and validators.
actions/checkout v7 blocks pwn requests: migration checklist
actions/checkout v7 refuses common unsafe fork checkout patterns and GitHub plans enforcement across supported majors. Replace privileged checkout-and-run workflows with unprivileged analysis or a reviewed two-stage design.
Control GitHub Actions workflow triggers with organization rulesets
Workflow execution protections add actor and event allowlists through GitHub rulesets. Run rules in evaluate mode, identify legitimate triggers, then block risky actors and events centrally.
Read-only GitHub Actions cache for untrusted triggers explained
GitHub now issues read-only cache tokens in default-branch contexts triggered by actors without write permission. Move cache population to trusted push or scheduled workflows and let untrusted runs restore only.
Restrict who can dismiss pull request reviews with GitHub rulesets
Control who may dismiss pull request reviews in GitHub rulesets, preserve emergency access, audit changes, and prevent approval bypasses.
GitHub secret scanning extended metadata and multipart validation explained
Use secret scanning ownership, expiry, project context, and multipart validation to prioritize leaked credentials and remediate faster.
GitHub innersource security advisories: private vulnerability workflow
Set up GitHub innersource security advisories for privately shared code, coordinated fixes, affected repositories, and controlled disclosure.
GitHub Code Quality organization targeting: a safe rollout plan
Roll out GitHub Code Quality at the organization level with repository targeting, baseline checks, ownership, and measurable adoption.
GitHub secret scanning detector names explained: patterns vs AI detection
Understand GitHub’s renamed secret scanning detector types, how pattern and AI detection differ, and how to triage each alert correctly.
CodeQL AI prompt injection detection: what the new query catches
Learn how CodeQL detects untrusted data flowing into AI system prompts, where the query helps, and what developers still need to review manually.